WO2018076365A1 - Key negotiation method and device - Google Patents

Abstract

Disclosed are a key negotiation method and device. The method comprises: generating a first random number, and using a first public key of a cloud server to encrypt the first random number and identification information about a terminal device so as to generate a first ciphertext; sending, to the cloud server, a key negotiation request comprising the first ciphertext and a second public key of the terminal device; receiving a key negotiation response comprising a second ciphertext and being sent by the cloud server after using the second public key to encrypt a session key comprising the first random number and after verifying that the terminal device is legitimate; and using a second private key to decrypt the second ciphertext, and when the first random number is obtained, using the session key to encrypt a first character string negotiated with the cloud server in advance, and sending a key acknowledgement response comprising a third ciphertext to the cloud server. By means of the method, two-way identity authentication of a terminal device and a cloud server can be realized, and a reliable and secure connection is established, thereby reducing the cost and improving the security of data transmission, and the method has a high efficiency.

Description

Key negotiation method and device Technical field

The present application relates to the field of information security technologies, and in particular, to a key negotiation method and apparatus.

Background technique

Generally, SSL (Secure Sockets Layer) is a security protocol that provides security and data integrity for network communication. It is often used to confirm the identity of the communicating parties when the terminal device communicates with the relevant server, and Avoid data leakage, encryption of communication data, etc.

However, in the above-mentioned way of using the SSL protocol for security services, most of the terminal devices cannot run SSL because of the large SSL memory usage, and the SSL is required to use a third-party CA company in the process of performing the service, and the operation is too complicated. And the server can only be authenticated, the terminal device cannot be authenticated, and the security is low.

Summary of the invention

The purpose of the present application is to solve at least one of the above technical problems to some extent.

To this end, the first object of the present application is to propose a key negotiation method, which can complete the two-way identity authentication of the terminal device and the cloud server, and establish a reliable secure connection, thereby reducing the cost and improving the data transmission. Safe and efficient.

A second object of the present application is to propose another method of key agreement.

A third object of the present application is to propose a key agreement apparatus.

A fourth object of the present application is to propose another key agreement apparatus.

A fifth object of the invention is to propose an apparatus.

A sixth object of the invention is to propose another device.

A seventh object of the present invention is to provide a nonvolatile computer storage medium.

An eighth object of the present invention is to provide another non-volatile computer storage medium.

In order to achieve the above object, the first aspect of the present application provides a key negotiation method, including the following steps: generating a first random number, applying a first public key of a cloud server to the first random number and a terminal device. The identification information is encrypted to generate a first ciphertext; the key negotiation request is sent to the cloud server, where the key negotiation request includes: the first ciphertext and the second public key of the terminal device, so as to After the first server decrypts the first ciphertext, the cloud server verifies the legality of the terminal device according to the identifier information and the second public key, and receives the cloud server to verify the terminal device. After being legal, the packet sent by encrypting the session key by applying the second public key a key agreement response of the second ciphertext, wherein the session key includes the first random number; applying the second private key to decrypt the second ciphertext, if the first random number is obtained And the first session string negotiated with the cloud server is encrypted by using the session key, and the key confirmation response including the third ciphertext is sent to the cloud server for the cloud server Decrypting the third ciphertext by using the session key, and determining whether the key negotiation is successful according to whether the first string is included in the decryption result.

In the key negotiation method of the embodiment of the present application, the encrypted first ciphertext is sent to the cloud server by the terminal device, and is decrypted by the cloud server, and the legality of the terminal device is verified according to the identifier information and the second public key, and The decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In addition, the key negotiation method in the embodiment of the present application further has the following additional technical features:

In an embodiment of the present application, the identifier information is a MAC address of the terminal device, and the key negotiation request further includes: a hash value of the first ciphertext, so that the cloud server application office After decrypting the first ciphertext, the first private key verifies the legality of the terminal device according to the MAC address, the hash value, and the second public key.

In an embodiment of the present application, the applying the session key to encrypt the first character string negotiated in advance with the cloud server, including: generating a random length of a preset length by using a random number generator according to a preset period. Splicing the random number with the first character string to generate a second character string; applying the session key to encrypt the second character string, and transmitting the third character string to the cloud server a key confirmation response of the ciphertext, wherein the cloud server applies the session key to decrypt the third ciphertext, and determines whether the key negotiation is successful according to whether the first string is included in the decryption result. .

In order to achieve the above object, the second aspect of the present application provides another key negotiation method, including the following steps: receiving a key negotiation request sent by a terminal device, where the key negotiation request includes: a first ciphertext And the second public key of the terminal device; the first private key of the application cloud server is used to decrypt the first ciphertext to obtain the first random number and the identification information of the terminal device, and the pre-stored query is performed according to the identifier information and the second public key. The license database verifies the legality of the terminal device; if the license database includes the identification information and the second public key, applying the second public key to encrypt the session key, and sending the session key to the terminal device a key agreement response including a second ciphertext, wherein the session key includes the first random number; and receiving, by the terminal device, the second private key to decrypt the second ciphertext to obtain the first a key confirmation response including a third ciphertext sent after the random number, applying the session key to decrypt the third ciphertext to obtain a decryption result; and detecting whether the decryption result includes The first string of the pre-negotiated terminal device determines whether the key negotiation is successful.

The key negotiation method in the embodiment of the present application receives the encrypted first ciphertext sent by the terminal device, decrypts the ciphertext, and then verifies the legality of the terminal device according to the identifier information and the second public key, and performs data decryption. again The encryption is simultaneously sent to the terminal device, and then the terminal device decrypts the second ciphertext after receiving the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In addition, the key negotiation method in the embodiment of the present application further has the following additional technical features:

In an embodiment of the present application, the applying the second public key to encrypt the session key comprises: generating a second random number, and splicing the second random number with the first random number to generate a session a key; the session key is encrypted by applying the second public key.

In order to achieve the above object, the third aspect of the present application provides a key agreement apparatus, including: an encryption module, configured to generate a first random number, and apply a first public key of a cloud server to the first random number and The identification information of the terminal device is encrypted to generate a first ciphertext; the sending module is configured to send a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and the terminal device a second public key, after the cloud server applies the first private key to decrypt the first ciphertext, and verifies the legality of the terminal device according to the identifier information and the second public key; And a key agreement response including the second ciphertext sent by the second public key after the second public key is encrypted, and the session key is included, after the cloud server is configured to verify that the terminal device is legal. a first random number; a decryption module, configured to apply the second private key to decrypt the second ciphertext, and when the first random number is obtained, apply the session key pair in advance The first string negotiated by the cloud server is encrypted, and a key confirmation response including the third ciphertext is sent to the cloud server, where the cloud server applies the session key to the third ciphertext. Decryption processing is performed, and whether the key negotiation is successful is determined according to whether the first character string is included in the decryption result.

The key agreement apparatus of the embodiment of the present invention sends the encrypted first ciphertext to the cloud server through the terminal device, decrypts the cloud file through the cloud server, and verifies the legality of the terminal device according to the identifier information and the second public key, and The decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In addition, the key agreement apparatus of the embodiment of the present application further has the following additional technical features:

In an embodiment of the present application, the identifier information is a MAC address of the terminal device, and the key negotiation request further includes: a hash value of the first ciphertext, so that the cloud server application office After decrypting the first ciphertext, the first private key verifies the legality of the terminal device according to the MAC address, the hash value, and the second public key.

In an embodiment of the present application, the decrypting module is configured to: generate a random number of a preset length by using a random number generator according to a preset period; and perform splicing processing on the random number and the first character string to generate a first a second string; the second string is encrypted by applying the session key, and a key confirmation response including the third ciphertext is sent to the cloud server, where the cloud server applies the session secret Decrypting the third ciphertext by the key, and rooting Whether the key negotiation is successful is determined according to whether the first string is included in the decrypted result.

In order to achieve the above object, the fourth aspect of the present application provides another key agreement apparatus, which includes: a receiving module, configured to receive a key negotiation request sent by a terminal device, where the key negotiation The request includes: a first ciphertext and a second public key of the terminal device; the query module is configured to decrypt the first ciphertext by using the first private key of the cloud server to obtain the first random number and the identifier information of the terminal device, according to the Determining the legality of the terminal device by using the identifier information and the second public key query pre-stored license database; the first processing module is configured to: when the license database includes the identifier information and the second public key, Applying the second public key to encrypt the session key, and sending a key agreement response including the second ciphertext to the terminal device, where the session key includes the first random number; and the second processing module, Receiving a key confirmation response including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first ciphertext, and applying the conference Decrypting the third ciphertext decryption result acquired; a detection module for detecting whether the decryption result string comprising a first pre-negotiated with the terminal device determines whether the key negotiation is successful.

The key negotiation apparatus in the embodiment of the present application, the key negotiation method in the embodiment of the present application, receives the encrypted first ciphertext sent by the terminal device, and decrypts the second ciphertext according to the identification information and the second public key. The legality, and the decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In addition, the key agreement apparatus of the embodiment of the present application further has the following additional technical features:

In an embodiment of the present application, the first processing module is configured to: generate a second random number, splicing the second random number and the first random number to generate a session key; and applying the second The public key encrypts the session key.

An embodiment of the fifth aspect of the present invention provides an apparatus, including: one or more processors; a memory; one or more programs, the one or more programs being stored in the memory when When the plurality of processors are executed, performing the following steps: generating a first random number, encrypting the first random number and the identification information of the terminal device by using the first public key of the cloud server to generate a first ciphertext; and sending the first ciphertext to the cloud The server sends a key negotiation request, where the key negotiation request includes: the first ciphertext and the second public key of the terminal device, so that the cloud server applies the first private key to decrypt the first After the ciphertext, verifying the legality of the terminal device according to the identifier information and the second public key; and after receiving the cloud server to verify that the terminal device is legal, applying the second public key to the session key a key agreement response including a second ciphertext sent after encryption, wherein the session key includes the first random number; and applying the second private key to solve the second ciphertext And if the first random number is obtained, applying the session key to encrypt a first character string negotiated in advance with the cloud server, and sending a key confirmation including the third ciphertext to the cloud server. In response, the cloud server applies the session key to decrypt the third ciphertext, and determines whether the key negotiation is successful according to whether the first string is included in the decryption result.

The device in the embodiment of the present application sends the encrypted first ciphertext to the cloud server through the terminal device, decrypts the cloud device through the cloud server, and verifies the legality of the terminal device according to the identifier information and the second public key, and obtains the decryption result. The data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

A sixth aspect of the present invention provides an apparatus, including: one or more processors; a memory; one or more programs, the one or more programs being stored in the memory when When the multiple processors are executed, the following steps are performed: receiving a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; and a first application cloud server The private key decrypts the first ciphertext to obtain the first random number and the identification information of the terminal device, and queries the pre-stored license database according to the identifier information and the second public key to verify the legality of the terminal device; The license database includes the identifier information and the second public key, and the second public key is used to encrypt the session key, and the key agreement response including the second ciphertext is sent to the terminal device, where The session key includes the first random number; and the receiving, by the terminal device, the second private key is used to decrypt the second ciphertext to obtain the first random number, and the a key confirmation response of the ciphertext, applying the session key to decrypt the third ciphertext to obtain a decryption result; and detecting whether the decryption result includes a first string determined in advance by the terminal device to determine whether the key negotiation is success.

The device of the embodiment of the present application receives the encrypted first ciphertext sent by the terminal device, decrypts the ciphertext, and then verifies the legality of the terminal device according to the identifier information and the second public key, and performs the decrypted data again. The encryption is simultaneously sent to the terminal device, and then the terminal device decrypts the second ciphertext after receiving the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

A seventh aspect of the present invention provides a non-volatile computer storage medium storing one or more programs, when the one or more programs are executed by a device, causing the device Performing the following steps: generating a first random number, encrypting the first random number and the identification information of the terminal device by using the first public key of the cloud server to generate a first ciphertext; and sending a key negotiation request to the cloud server, The key negotiation request includes: the first ciphertext and the second public key of the terminal device, so that the cloud server applies the first private key to decrypt the first ciphertext, according to the Determining the legality of the terminal device by using the identifier information and the second public key; after receiving the cloud server to verify that the terminal device is legal, the second public key is used to encrypt the session key and then sent a key agreement response of the ciphertext, wherein the session key includes the first random number; applying the second private key to decrypt the second ciphertext, if obtained The first random number is used to encrypt the first character string negotiated in advance with the cloud server by using the session key, and send a key confirmation response including the third ciphertext to the cloud server for the Decoding the third ciphertext by using the session key by the cloud server Processing, and determining whether the key negotiation is successful according to whether the first string is included in the decrypted result.

The non-volatile computer storage medium of the embodiment of the present application sends the encrypted first ciphertext to the cloud server through the terminal device, decrypts the cloud file through the cloud server, and verifies the legality of the terminal device according to the identifier information and the second public key. And encrypting the decrypted data again, sending it to the terminal device, and then decrypting the second ciphertext after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

An eighth aspect of the present invention provides a non-volatile computer storage medium storing one or more programs, when the one or more programs are executed by one device, causing the device The following steps are performed: receiving a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; and decrypting the first by using a first private key of the cloud server Obtaining the first random number and the identification information of the terminal device, and verifying the legality of the terminal device according to the identifier information and the second public key querying the pre-stored license database; if the license database includes the identifier information And the second public key, the second public key is used to encrypt the session key, and the key agreement response including the second ciphertext is sent to the terminal device, where the session key includes the first a random number; receiving a key including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first random number In response to applying the third session key to decrypt the ciphertext decryption result acquired; detecting whether the decryption result string comprising a first pre-negotiated with the terminal device determines whether the key negotiation is successful.

The non-volatile computer storage medium of the embodiment of the present application receives the encrypted first ciphertext sent by the terminal device, decrypts the ciphertext, and then verifies the legality of the terminal device according to the identification information and the second public key, and decrypts the The data is obtained for another encryption, and is simultaneously transmitted to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

The aspects and advantages of the present invention will be set forth in part in the description which follows.

DRAWINGS

The above and/or additional aspects and advantages of the present invention will become apparent and readily understood from

1 is a flowchart of a key agreement method according to an embodiment of the present application;

2 is a flowchart of a key agreement method according to another embodiment of the present application;

FIG. 3 is a schematic diagram of a key agreement method according to an embodiment of the present application; FIG.

4 is a schematic structural diagram of a key agreement apparatus according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a key agreement apparatus according to another embodiment of the present application.

detailed description

The embodiments of the present application are described in detail below, and the examples of the embodiments are illustrated in the drawings, wherein the same or similar reference numerals are used to refer to the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are intended to be illustrative, and are not to be construed as limiting.

The key negotiation method and apparatus of the embodiment of the present application are described below with reference to the accompanying drawings.

Generally, when SSL provides security services for network communication, the CA certificate is used on the device side, and the device is authenticated by encrypting and decrypting the public and private keys of the device.

For example, the terminal device sends a connection request to the server, and the server sends its own CA certificate and information related to the CA certificate to the terminal device, and the terminal device checks whether the CA certificate sent by the server is issued by the CA center trusted by the server. .

If yes, the SSL protocol is executed. The terminal device compares the information of the CA certificate, such as the domain name and public key, with the information previously sent by the server. The authentication server is legal only when the information is consistent.

Further, when the server is legal, the server selects a password scheme with the highest degree of encryption from the password scheme sent by the terminal device, and notifies the terminal device after adding the password of the terminal device, and the terminal device selects the password scheme for the password scheme. A call key, which is then sent to the server using the server's public key.

Therefore, the server receives the information sent by the terminal device, decrypts the private key to obtain the session key, and the server and the browser exchange information according to the password symmetric scheme.

Therefore, it can be seen that when using the SSL protocol for communication, only the server can be authenticated, the terminal device cannot be authenticated, and the SSL is relatively too large. Most terminal devices cannot run SSL, which is low in feasibility and SSL requires the help of a third-party CA company, and the operation is too complicated. And the server can only be authenticated, the terminal device cannot be authenticated, and the security is low.

In order to solve the above problem, the present application proposes a key negotiation method, which can complete the two-way identity authentication of the terminal device and the cloud server, and establish a reliable secure connection, thereby reducing the cost, which improves the security and efficiency of data transmission. high. details as follows:

1 is a flow chart of a method of key agreement in accordance with one embodiment of the present application.

As shown in FIG. 1, the key negotiation method includes:

Step 110: Generate a first random number, and apply the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate a first ciphertext.

Specifically, the first random number of the preset length may be generated by the random number generator. Where the preset length can be rooted Set as needed, such as 5 strings, 10 strings, and so on. The random number may be one or more of letters, numbers, special symbols, and the like.

Further, the terminal device may obtain its own identification information, and may perform an encryption operation on the obtained first random number and the identification information by using the first public key of the cloud server that is stored in advance to generate the first ciphertext.

The identifier information may be a MAC (Media Access Control) address, or may be an International Mobile Equipment Identity (IMEI), or may be other device identification information, and may be performed according to actual application requirements. Select settings.

The first public key is a key that is pre-agreed with the cloud server and can encrypt the plaintext.

For example, the cloud server may pre-generate a pair of permanent first private key and first public key pair by using an asymmetric algorithm, and store it on the cloud server, and the cloud server sends the first public key to the terminal device. Therefore, when the terminal device initiates the connection establishment request to the cloud server, the cloud server can verify the identity of the terminal device by using the first private key to ensure that the illegal terminal device establishes a connection with the cloud server, thereby further improving the security of data transmission.

Step 120: Send a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and the second public key of the terminal device, so that the cloud server applies the first public key to decrypt the first ciphertext, according to the identifier. The information and the second public key verify the legitimacy of the terminal device.

Specifically, after the terminal device sends the key negotiation request including the first ciphertext and the second public key of the terminal device to the cloud server, the cloud server may use the first private key to decrypt the first ciphertext to obtain the first random number. And identification information.

Wherein, when the identification information is the MAC address of the terminal device, the validity of the terminal device is verified according to the MAC and the second public key by checking the license database at the same time to confirm whether the license server has generated the MAC and the second public key.

Alternatively, the key negotiation request further includes a hash value of the first ciphertext, so that the cloud server applies the first public key to decrypt the first ciphertext, and then verifies the terminal device according to the MAC address, the hash value, and the second public key. legality.

It should be noted that, if the first private key is used to decrypt the first ciphertext successfully, and subsequent verification is performed, if the first public key is used to decrypt the first ciphertext, the cloud server may use the terminal device as an illegal terminal device, and no longer perform the process. Subsequent verification.

Step 130: After receiving the cloud server to verify that the terminal device is legal, the second public key is used to encrypt the session key and then send a key agreement response including the second ciphertext, where the session key includes the first random number.

Specifically, after the first ciphertext is successfully decrypted, and the plaintext information of the first ciphertext is obtained, the cloud server uses the received second public key to encrypt the session key including the first random number to obtain a second operation. The ciphertext is then sent to the terminal device.

In order to further improve the security of the data transmission, after the first ciphertext is successfully decrypted and the plaintext information of the first ciphertext is obtained, the cloud server may further generate a second random number, the first random number and the second random number. The number is spliced to obtain spliced data, and the spliced data is encrypted by using the received second public key to obtain a second ciphertext. The second ciphertext is then sent to the terminal device. That is to say, the second ciphertext further includes a second random number generated by the cloud server.

It should be noted that the first random number must be included in the session key, and the second random number or other data may be added to further improve security.

Step 140: The second public key is used to decrypt the second ciphertext. If the first random number is obtained, the session key is used to encrypt the first character string negotiated in advance with the cloud server, and the third server is sent to the cloud server. The key confirmation response of the file is used for decrypting the third ciphertext by the cloud server application session key, and determining whether the key negotiation is successful according to whether the first string is included in the decryption result.

Specifically, after receiving the second ciphertext, the terminal device decrypts the second private key of the terminal device, and after the decryption succeeds, compares the generated first random number with the decrypted plaintext information. If the comparison result includes the first random number, the terminal device confirms that the cloud server passes the authentication.

Further, after determining that the cloud server passes the identity authentication, the application session key encrypts the first character string negotiated in advance with the cloud server, and sends a key confirmation response including the third ciphertext to the cloud server for the cloud server application. The session key decrypts the third ciphertext, and determines whether the key negotiation is successful according to whether the first string is included in the decryption result.

The encrypting the first character string negotiated in advance with the cloud server by using the session key may be understood as firstly generating a random number of a preset length by using a random number generator according to a preset period.

Further, the random number is spliced with the first character string to generate a second character string.

Further, the application session key encrypts the second character string, and sends a key confirmation response including the third ciphertext to the cloud server, so that the cloud server applies the session key to decrypt the third ciphertext, and decrypts according to the decryption process. Whether the result contains the first string determines whether the key negotiation is successful.

The preset period can be set as needed, for example, 10 minutes, 20 minutes, and the like.

The preset length can be set as needed, for example, 5 strings, 10 strings, and the like.

The random number may be one or more of letters, numbers, special symbols, and the like.

It should be noted that the splicing process can be understood as “random number + first character string”, and can also be understood as “first character string + random number”, and can also be understood as random characters arbitrarily inserted into each character of the first character string. Wait.

Specifically, the result of encrypting the second character string by using a session key pre-negotiated with the cloud server may be used as the third ciphertext by, for example, an MD5 encryption algorithm, a DES encryption algorithm, an RSA encryption algorithm, or the like.

Further, the third ciphertext is sent to the cloud server, and the cloud server uses the corresponding decryption.

The algorithm performs decryption processing on the third ciphertext by using a session key pre-negotiated with the terminal device.

Further, it is determined whether the first character string is included in the decryption result to determine whether the terminal device negotiates with the server successfully.

In the key negotiation method of the embodiment of the present application, the encrypted first ciphertext is sent to the cloud server by the terminal device, and is decrypted by the cloud server, and the legality of the terminal device is verified according to the identifier information and the second public key, and The decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

2 is a flow chart of a method of key agreement in accordance with another embodiment of the present application.

As shown in FIG. 2, the key negotiation method includes:

Step 210: Receive a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device.

Step 220: The first private key of the cloud server is used to decrypt the first ciphertext to obtain the first random number and the identification information of the terminal device, and the pre-stored license database is queried according to the identifier information and the second public key to verify the legality of the terminal device.

Specifically, after the cloud server receives the key negotiation request sent by the terminal device, the cloud server may use the first private key to decrypt the first ciphertext, and obtain the first random number and the identification information of the terminal device.

For details of the identification information, refer to step 110, which is not described in detail here.

Wherein, the validity of the terminal device can be verified according to the MAC and the second public key by simultaneously querying the license database to confirm whether the license server has generated the MAC and the second public key.

It should be noted that, if the first private key is used to decrypt the first ciphertext successfully, and subsequent verification is performed, if the first public key is used to decrypt the first ciphertext, the cloud server may use the terminal device as an illegal terminal device, and no longer perform the process. Subsequent verification.

Step 230: If the license database includes the identifier information and the second public key, encrypt the session key by applying the second public key, and send a key agreement response including the second ciphertext to the terminal device, where the session key includes the first random number.

Step 240: The receiving terminal device applies a second private key to decrypt the second ciphertext to obtain a key acknowledgment response including the third ciphertext after the first random number is obtained, and decrypts the third ciphertext by using the session key to obtain the decryption result.

Specifically, the license database includes the identifier information and the second public key, and the session key including the first random number is encrypted by using the received second public key to obtain a second ciphertext, and then the second ciphertext is sent to Terminal Equipment.

In order to further improve the security of data transmission, a second random number may be generated, the second random number is spliced with the first random number to generate a session key, and the session key is encrypted by applying a second public key.

Further, the cloud server sends a key agreement response including the second ciphertext to the terminal device. Therefore, the receiving terminal device uses the second private key to decrypt the second ciphertext to obtain the key acknowledgment response including the third ciphertext after the first random number is obtained, and decrypts the third ciphertext by using the session key to obtain the decrypted result.

Step 250: Detect whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful.

Specifically, the third ciphertext is sent to the cloud server, and the cloud server uses the corresponding decryption.

The algorithm performs decryption processing on the third ciphertext by using a session key pre-negotiated with the terminal device.

Further, it is determined whether the first character string is included in the decryption result to determine whether the terminal device negotiates with the server successfully.

It should be noted that, when detecting that the decrypted result includes the first character string, the key information that is negotiated with the terminal device is applied to encrypt or decrypt the interaction information. That is, after the key negotiation ends, the interaction information may be processed by using the key information negotiated with the terminal device, which may be one or more of encryption and decryption.

The key negotiation method in the embodiment of the present application receives the encrypted first ciphertext sent by the terminal device, decrypts the ciphertext, and then verifies the legality of the terminal device according to the identifier information and the second public key, and performs data decryption. Once again, the encryption is simultaneously sent to the terminal device, and then the terminal device decrypts the second ciphertext after it receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In order to make the above implementation process more clear to those skilled in the art, the following examples are described as follows:

FIG. 3 is a schematic diagram of a key agreement method according to an embodiment of the present application.

As shown in FIG. 3, the smart terminal can send a key negotiation request to the cloud server by means of a wireless connection (WIFI, Bluetooth, ZigBee, etc.), wherein the key negotiation request includes the first ciphertext and the second public key.

The first ciphertext is obtained by encrypting the first random number R1 and the MAC address of the terminal device by using the first public key of the cloud server. After the cloud server receives the key negotiation request, the key negotiation request may be decrypted to obtain corresponding plaintext information, that is, the first random number R1, the MAC address of the terminal device, and the second public key of the terminal device.

In addition, the cloud server may further generate a second random number R2, and then encrypt the first random number R1 and the second random number R2 obtained by using the second public key to obtain a second ciphertext, and send the second ciphertext to the terminal device.

Further, after receiving the second ciphertext, the terminal device may use the second private key to decrypt the second ciphertext, and after the decryption succeeds, send the encrypted authentication pass information to the cloud server, where the authentication pass information is sent. It may be that the pre-set confirmation information ("OK" or the like in FIG. 3) is encrypted and generated based on the first random number R1 and the second random number R2.

Further, after receiving the authentication pass information, the cloud server decrypts the information to obtain pre-set character information, and then establishes a secure communication connection according to the authentication pass information.

In the key negotiation method of the embodiment of the present application, the encrypted first ciphertext is sent to the cloud server by the terminal device, and is decrypted by the cloud server, and the legality of the terminal device is verified according to the identifier information and the second public key, and The decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity of the terminal device and the cloud server can be completed. Proof and establish a reliable and secure connection, which reduces costs, which improves the security and efficiency of data transmission.

To achieve the above object, the present application also proposes a key agreement apparatus.

FIG. 4 is a schematic structural diagram of a key agreement apparatus according to an embodiment of the present application.

As shown in FIG. 4, the key agreement apparatus may include an encryption module 41, a sending module 42, a response module 43, and a decryption module 44.

The cryptographic module 41 is configured to generate a first random number, and apply the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate the first ciphertext.

The sending module 42 is configured to send a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and the second public key of the terminal device, so that the cloud server applies the first private key to decrypt the first ciphertext, The validity of the terminal device is verified according to the identification information and the second public key.

The response module 43 is configured to receive a key agreement response that includes the second ciphertext after the cloud server verifies that the terminal device is legal, and the second public key is used to encrypt the session key, where the session key includes the first random number.

The decryption module 44 is configured to use the second private key to decrypt the second ciphertext. When the first random number is obtained, the application session key encrypts the first string negotiated in advance with the cloud server, and sends the first string to the cloud server. The key confirmation response of the third ciphertext is used for decrypting the third ciphertext by the cloud server application session key, and determining whether the key negotiation is successful according to whether the first string is included in the decryption result.

In an embodiment of the present application, the identifier information is a MAC address of the terminal device, and the key negotiation request further includes: a hash value of the first ciphertext, so that the cloud server applies the first private key to decrypt the first ciphertext. After that, the validity of the terminal device is verified according to the MAC address, the hash value, and the second public key.

In an embodiment of the present application, the decrypting module 44 is configured to generate a random number of a preset length by using a random number generator according to a preset period, and perform a splicing process on the random number and the first character string to generate a second character string. Encrypting the second character string by using the session key, and sending a key confirmation response including the third ciphertext to the cloud server, so that the cloud server applies the session key to decrypt the third ciphertext, and according to whether the decryption result is The first string is included to determine if the key negotiation is successful.

The key agreement device provided by the embodiment of the present invention corresponds to the key agreement method provided by the foregoing first embodiment. Therefore, the implementation manner of the foregoing key negotiation method is also applicable to the key agreement device provided in this embodiment. This embodiment will not be described in detail.

The key agreement apparatus of the embodiment of the present invention sends the encrypted first ciphertext to the cloud server through the terminal device, decrypts the cloud file through the cloud server, and verifies the legality of the terminal device according to the identifier information and the second public key, and The decrypted data is encrypted again, sent to the terminal device, and then decrypted after the terminal device receives the second ciphertext to verify the identity. Thereby, the two-way identity of the terminal device and the cloud server can be completed. Proof and establish a reliable and secure connection, which reduces costs, which improves the security and efficiency of data transmission.

FIG. 5 is a schematic structural diagram of a key agreement apparatus according to another embodiment of the present application.

As shown in FIG. 5, the key agreement apparatus may include: a receiving module 51, a querying module 52, a first processing module 53, a second processing module 54, and a detecting module 55.

The receiving module 51 is configured to receive a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device.

The query module 52 is configured to use the first private key of the cloud server to decrypt the first ciphertext to obtain the first random number and the identification information of the terminal device, and query the pre-stored license database according to the identifier information and the second public key to verify the legality of the terminal device.

The first processing module 53 is configured to: when the license database includes the identifier information and the second public key, apply the second public key to encrypt the session key, and send a key agreement response including the second ciphertext to the terminal device, where the session is dense The key includes a first random number.

The second processing module 54 is configured to receive a key confirmation response including a third ciphertext sent by the terminal device after the second private cipher is decrypted by the second private cipher, and decrypt the third ciphertext by using the session key to obtain the decryption. result.

The detecting module 55 is configured to detect whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful.

In an embodiment of the present application, the first processing module 53 is configured to generate a second random number, splicing the second random number with the first random number to generate a session key, and applying the second public key to the session key. encryption.

The key agreement device provided by the embodiment of the present invention corresponds to the key negotiation method provided in the foregoing second embodiment. Therefore, the implementation of the foregoing key negotiation method is also applicable to the key agreement device provided in this embodiment. This embodiment will not be described in detail.

The key agreement apparatus of the embodiment of the present invention receives the encrypted first ciphertext sent by the terminal device, decrypts the ciphertext, and then verifies the legality of the terminal device according to the identifier information and the second public key, and performs data decryption. Once again, the encryption is simultaneously sent to the terminal device, and then the terminal device decrypts the second ciphertext after it receives the second ciphertext to verify the identity. Thereby, the two-way identity authentication of the terminal device and the cloud server can be completed, and a reliable and secure connection is established, which reduces the cost, which improves the security of the data transmission and is highly efficient.

In the description of the present specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the application. In the present specification, the schematic representation of the above terms is not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, various embodiments or examples described in the specification, as well as features of various embodiments or examples, may be combined and combined.

While the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are illustrative and are not to be construed as limiting the scope of the present application. The embodiments are subject to variations, modifications, substitutions and variations.

Claims (14)

A key negotiation method, comprising the steps of: Generating a first random number, and applying the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate a first ciphertext; Sending a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and a second public key of the terminal device, so that the cloud server applies the first private key After decrypting the first ciphertext, verifying the legality of the terminal device according to the identifier information and the second public key; Receiving, by the cloud server, the key agreement response including the second ciphertext sent by the second public key after the session key is encrypted, wherein the session key includes the first a random number; Applying the second private key to decrypt the second ciphertext, and if the first random number is obtained, applying the session key to encrypt the first character string negotiated in advance with the cloud server, The cloud server sends a key confirmation response including the third ciphertext, so that the cloud server applies the session key to decrypt the third ciphertext, and according to whether the decryption result includes the The first string determines if the key negotiation was successful. The method according to claim 1, wherein the identification information is a MAC address of the terminal device; The key negotiation request further includes: a hash value of the first ciphertext, so that the cloud server applies the first private key to decrypt the first ciphertext, according to the MAC address, The hash value and the second public key verify the legitimacy of the terminal device. The method of claim 1, wherein the applying the session key to encrypt a first character string negotiated in advance with the cloud server comprises: Generating a random number of a preset length by a random number generator according to a preset period; Splicing the random number with the first character string to generate a second character string; Encrypting the second character string by using the session key, and sending a key confirmation response including the third ciphertext to the cloud server, where the cloud server applies the session key pair to the The third ciphertext performs decryption processing, and determines whether the key negotiation is successful according to whether the first character string is included in the decryption result. A key negotiation method, comprising the steps of: Receiving a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; Decrypting the first ciphertext of the cloud server to obtain the first random number and the identification information of the terminal device, and querying the pre-stored license database according to the identifier information and the second public key to verify the terminal device legality; And if the license database includes the identifier information and the second public key, applying the second public key to encrypt the session key, and sending a key agreement response including the second ciphertext to the terminal device, where The session key includes The first random number; Receiving a key confirmation response including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first ciphertext, and applying the session key to decrypt the first The third ciphertext obtains the decrypted result; It is detected whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful. The method of claim 4, wherein the applying the second public key to encrypt the session key comprises: Generating a second random number, and splicing the second random number with the first random number to generate a session key; The session key is encrypted by applying the second public key. A key agreement device, comprising: The cryptographic module is configured to generate a first random number, and use the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate a first ciphertext; a sending module, configured to send a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and a second public key of the terminal device, so that the cloud server application office After the first private key decrypts the first ciphertext, verifying the legality of the terminal device according to the identifier information and the second public key; a response module, configured to receive a key agreement response that includes the second ciphertext sent by the second public key after the cloud server is authenticated by the cloud server, where the session key is encrypted. The key includes the first random number; a decryption module, configured to apply the second private key to decrypt the second ciphertext, and when the first random number is obtained, apply the session key to a first character negotiated in advance with the cloud server The string is encrypted, and the key confirmation response including the third ciphertext is sent to the cloud server, so that the cloud server applies the session key to decrypt the third ciphertext, and according to the decryption result Whether the first string is included in the determination whether the key negotiation is successful. The device according to claim 6, wherein the identification information is a MAC address of the terminal device; The key negotiation request further includes: a hash value of the first ciphertext, so that the cloud server applies the first private key to decrypt the first ciphertext, according to the MAC address, The hash value and the second public key verify the legitimacy of the terminal device. The apparatus of claim 6 wherein said decryption module is for: Generating a random number of a preset length by a random number generator according to a preset period; Splicing the random number with the first character string to generate a second character string; Encrypting the second character string by using the session key, and sending a key confirmation response including the third ciphertext to the cloud server, where the cloud server applies the session key pair to the Third ciphertext decryption And determining whether the key negotiation is successful according to whether the first string is included in the decryption result. A key agreement device, comprising: a receiving module, configured to receive a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; a query module, configured to decrypt the first ciphertext by using the first private key of the cloud server to obtain the first random number and the identification information of the terminal device, and query the pre-stored license database verification according to the identifier information and the second public key. Legality of the terminal device; a first processing module, configured to: when the license database includes the identifier information and the second public key, apply the second public key to encrypt a session key, and send the second ciphertext to the terminal device Key negotiation response, wherein the session key includes the first random number; a second processing module, configured to receive a key confirmation response including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first ciphertext, and apply the Decrypting the third ciphertext by the session key to obtain a decryption result; And a detecting module, configured to detect whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful. The apparatus of claim 9, wherein the first processing module is configured to: Generating a second random number, and splicing the second random number with the first random number to generate a session key; Encrypting the session key by applying the second public key An apparatus, comprising: One or more processors; Memory One or more programs, the one or more programs being stored in the memory, and when executed by the one or more processors, performing the following steps: Generating a first random number, and applying the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate a first ciphertext; Sending a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and a second public key of the terminal device, so that the cloud server applies the first private key After decrypting the first ciphertext, verifying the legality of the terminal device according to the identifier information and the second public key; Receiving, by the cloud server, the key agreement response including the second ciphertext sent by the second public key after the session key is encrypted, wherein the session key includes the first a random number; Applying the second private key to decrypt the second ciphertext, and if the first random number is obtained, applying the session key to encrypt the first character string negotiated in advance with the cloud server, The cloud server sends a packet a key confirmation response of the third ciphertext, wherein the cloud server applies the session key to decrypt the third ciphertext, and determines whether the first string is included in the decryption result. Whether the key negotiation was successful. An apparatus, comprising: One or more processors; Memory One or more programs, the one or more programs being stored in the memory, and when executed by the one or more processors, performing the following steps: Receiving a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; Decrypting the first ciphertext of the cloud server to obtain the first random number and the identification information of the terminal device, and querying the pre-stored license database according to the identifier information and the second public key to verify the terminal device legality; And if the license database includes the identifier information and the second public key, applying the second public key to encrypt the session key, and sending a key agreement response including the second ciphertext to the terminal device, where The session key includes the first random number; Receiving a key confirmation response including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first ciphertext, and applying the session key to decrypt the first The third ciphertext obtains the decrypted result; It is detected whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful. A non-volatile computer storage medium, characterized in that the computer storage medium stores one or more programs, when the one or more programs are executed by a device, causing the device to perform the following steps: Generating a first random number, and applying the first public key of the cloud server to encrypt the first random number and the identification information of the terminal device to generate a first ciphertext; Sending a key negotiation request to the cloud server, where the key negotiation request includes: the first ciphertext and a second public key of the terminal device, so that the cloud server applies the first private key After decrypting the first ciphertext, verifying the legality of the terminal device according to the identifier information and the second public key; Receiving, by the cloud server, the key agreement response including the second ciphertext sent by the second public key after the session key is encrypted, wherein the session key includes the first a random number; Applying the second private key to decrypt the second ciphertext, and if the first random number is obtained, applying the session key to encrypt the first character string negotiated in advance with the cloud server, The cloud server sends a key confirmation response including the third ciphertext, so that the cloud server applies the session key to decrypt the third ciphertext, and according to whether the decryption result includes the The first string determines if the key negotiation was successful. A non-volatile computer storage medium, characterized in that the computer storage medium stores one or A plurality of programs, when the one or more programs are executed by a device, cause the device to perform the following steps: Receiving a key negotiation request sent by the terminal device, where the key negotiation request includes: a first ciphertext and a second public key of the terminal device; Decrypting the first ciphertext of the cloud server to obtain the first random number and the identification information of the terminal device, and querying the pre-stored license database according to the identifier information and the second public key to verify the terminal device legality; And if the license database includes the identifier information and the second public key, applying the second public key to encrypt the session key, and sending a key agreement response including the second ciphertext to the terminal device, where The session key includes the first random number; Receiving a key confirmation response including the third ciphertext sent by the terminal device after the second private key is decrypted by the second private key to obtain the first ciphertext, and applying the session key to decrypt the first The third ciphertext obtains the decrypted result; It is detected whether the decryption result includes whether the first string determined in advance with the terminal device determines whether the key negotiation is successful.

Images